What is the CVSS score of CVE-2026-8859?

CVE-2026-8859 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow are affected by CVE-2026-8859?

IBM Langflow 1.0.0-1.10.0 contains a critical arbitrary file write vulnerability (CVSS 9.9) that allows attackers controlling external HTTP servers to plant files anywhere on vulnerable systems, with…. A patch is available.

How to fix or mitigate CVE-2026-8859?

Within 24 hours, audit all deployments of Langflow 1.0.0-1.10.0 across your infrastructure and identify systems requiring immediate updates. Within 7 days, apply the vendor-released patch from IBM to upgrade all affected instances to the corrected version. Within 30 days, conduct a system integrity review on patched Langflow hosts to verify no malicious files were written during the vulnerability window, and review logs for suspicious external HTTP server interactions from your Langflow instances.

IBM Langflow CVE-2026-8859

EUVD-2026-45269 CRITICAL

Path Traversal (CWE-22)

2026-07-17 ibm

GHSA-mvq6-wcf9-wpxf

IBM Path Traversal Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

AC:H because Save-to-File must be enabled and the victim flow must hit an attacker-controlled server; PR:L for flow-author access; C:L since a write primitive yields only indirect confidentiality; I:H/A:H for arbitrary write and S:C for host-level reach.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:46 vuln.today

CVE Published

Jul 17, 2026 - 18:58 cve.org

CRITICAL 9.9

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary directory path. An attacker controlling an external HTTP server can supply crafted filename values containing path traversal sequences (e.g., ../), enabling arbitrary file writes to locations accessible by the Langflow process.

AnalysisAI

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.

Technical ContextAI

Langflow is an open-source, low-code Python framework for visually building LLM and AI-agent workflows; the vulnerable APIRequest component is a node that makes outbound HTTP requests and can persist responses to disk when 'Save to File' is enabled. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the code derives the output filename from the HTTP response's Content-Disposition header and joins it to the temp directory without normalizing or rejecting '../' sequences or absolute paths. Because the filename is fully controlled by whatever server Langflow talks to, an attacker who owns or hijacks that upstream endpoint decides where the bytes land. The affected package is identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* across versions 1.0.0 to 1.10.0.

RemediationAI

Patch available per vendor advisory - apply the fixed IBM Langflow OSS release referenced at https://www.ibm.com/support/pages/node/7278924 (exact fixed version not stated in the provided data; confirm the target version in the advisory before upgrading and do not assume a version number). Until patched, disable the 'Save to File' option on APIRequest components, since that feature is the exploitation gate and disabling it removes the write path at the cost of losing response-to-disk persistence in those flows. Additionally, restrict APIRequest destinations to trusted, allowlisted hosts so flows cannot be pointed at attacker-controlled servers, and run the Langflow process under a low-privilege service account with a tightly-scoped filesystem so a successful traversal cannot overwrite application code, cron/startup files, or config - the trade-off being that overly strict filesystem permissions may break legitimate file-writing flows and require testing.